# cdxgen

cdxgen is a CLI tool, library, REPL, and server to create, validate, sign, and verify software BOMs. It generates CycloneDX JSON BOMs and supports SPDX 3.0.1 JSON-LD export.

- Tier: Indexed (plain plugin)
- Category: Security
- Page: https://www.flowy.sh/listings/cdxgen-cdxgen
- Source: https://github.com/cdxgen/cdxgen
- Price: free and open source

## Summary
cdxgen is a Claude Code plugin with 14 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes ai-bom, bom-audit, bom-convert-validate. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.

## Install (Claude Code)
```
/plugin marketplace add cdxgen/cdxgen
/plugin install cdxgen@cdxgen-plugins
```

## Skills
- ai-bom
- bom-audit
- bom-convert-validate
- bom-evidence
- bom-explore
- bom-signing
- bom-slimmer
- container-sbom
- crypto-bom
- dependency-track-upload
- os-hardware-inventory
- runtime-trace-bom
- sbom-fidelity-loop
- sbom-generate

## FAQ

### What is cdxgen?
cdxgen is a CLI tool, library, REPL, and server to create, validate, sign, and verify software BOMs. It generates CycloneDX JSON BOMs and supports SPDX 3.0.1 JSON-LD export.

### How do I install cdxgen?
Run these in Claude Code: /plugin marketplace add cdxgen/cdxgen then /plugin install cdxgen@cdxgen-plugins. Then prompt normally.

### Does cdxgen auto-invoke its skills?
Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.

### Is cdxgen free?
Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.